Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data
Exposed Vietnam-linked APIS database held 220.8 million passenger and crew records with passport and flight data from January 2017 to April 2026.
Kinryū Labs discovered an exposed Elasticsearch cluster named 'pax-info' containing 220.8 million passenger and crew records, about 107 GB across 29 indices, hosted on IP space assigned to Viettel in Hanoi. The records include names, birth dates, nationalities, passport numbers, and detailed flight information from airlines across Asia-Pacific, Europe and the Middle East. Researchers reported the exposure on June 3 and the database was secured by June 8 with Singapore Airlines coordinating; no evidence of theft was found, but missing server logs mean access cannot be ruled out.
- Database exposed via two misconfigurations, reachable through a cloud path with default credentials
- Records cover travel events, not unique individuals, over a nine-year span
- FOFA first detected the host in 2022; actual exposure window unknown
- No ransom notes or tampering found, but no logs to confirm data was not copied
- Vietnamese authorities, affected airlines and national CERTs were notified
- Vendors
- Kinryū Labs
- Products
- Elasticsearch
- Victims
- Singapore Airlines
- Organizations
- Viettel
- Countries
- Vietnam
From the original article
2 min read at securityaffairs.com
An exposed Vietnam-linked APIS database contained 220. 8 million passenger and crew records, including passport and flight data. Researchers found an exposed Advance Passenger Information System (APIS) database containing 220.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.